Skip to content

Commit 98ad23b

Browse files
committed
Consistent logging of encoded path evaluation failure
Issue: SPR-16616
1 parent 75f70b2 commit 98ad23b

File tree

2 files changed

+12
-2
lines changed

2 files changed

+12
-2
lines changed

spring-webflux/src/main/java/org/springframework/web/reactive/resource/PathResourceResolver.java

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -193,7 +193,12 @@ private boolean isInvalidEncodedPath(String resourcePath) {
193193
// Use URLDecoder (vs UriUtils) to preserve potentially decoded UTF-8 chars...
194194
try {
195195
String decodedPath = URLDecoder.decode(resourcePath, "UTF-8");
196-
return (decodedPath.contains("../") || decodedPath.contains("..\\"));
196+
if (decodedPath.contains("../") || decodedPath.contains("..\\")) {
197+
if (logger.isTraceEnabled()) {
198+
logger.trace("Ignoring invalid resource path with escape sequences [" + resourcePath + "]");
199+
}
200+
return true;
201+
}
197202
}
198203
catch (UnsupportedEncodingException ex) {
199204
// Should never happen...

spring-webmvc/src/main/java/org/springframework/web/servlet/resource/PathResourceResolver.java

Lines changed: 6 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -284,7 +284,12 @@ private boolean isInvalidEncodedPath(String resourcePath) {
284284
// Use URLDecoder (vs UriUtils) to preserve potentially decoded UTF-8 chars...
285285
try {
286286
String decodedPath = URLDecoder.decode(resourcePath, "UTF-8");
287-
return (decodedPath.contains("../") || decodedPath.contains("..\\"));
287+
if (decodedPath.contains("../") || decodedPath.contains("..\\")) {
288+
if (logger.isTraceEnabled()) {
289+
logger.trace("Ignoring invalid resource path with escape sequences [" + resourcePath + "]");
290+
}
291+
return true;
292+
}
288293
}
289294
catch (UnsupportedEncodingException ex) {
290295
// Should never happen...

0 commit comments

Comments
 (0)